Draft This notice is a draft. It has not been through legal review and is not yet a binding statement.
Samipyo is not yet in service. Nothing on this page describes a live service; it describes how the platform is designed to handle data.
Privacy notice
This website
This website is a static public site. It has no sign-in, no cookies, no analytics, no advertising, no third-party scripts or fonts, and no forms that send information anywhere. It holds no student data.
Choosing Log in or Register takes you to the Samipyo web app, which is a separate service.
The platform
The platform is designed to process children's location and presence data for school and transport safety only. The school is the accountable party and the platform acts on its behalf.
- The platform is designed to process location only during an active school or transport session.
- The platform is not designed to profile children's behaviour.
- The platform is not designed to serve targeted advertising.
- The platform is not designed for secondary analytics on individual children.
- The intended use of the data is school and transport safety.
- The platform is designed so that its logs do not carry names, locations or device identifiers.
What the platform is designed to record
- Evidence events from manual confirmation and bus GPS during active trips, each with its source (more sources are planned).
- Derived student states.
- Exceptions and their resolutions.
- Notifications.
- An audit log of corrections.
- Account records for school staff and parents.
How long data is kept
The periods below are maximums ("at most"). Retention is enforced by a scheduled deletion job designed to remove expired rows. A school may set shorter periods but never longer ones. These periods are design limits, not a promise about any individual record before the job has run.
| Kind of data | How long it is kept |
|---|---|
| Raw evidence | At most 90 days |
| Event history (states, exceptions, notifications) | At most 3 years |
| Audit logs | At most 3 years |
| Non-identifying summary statistics | Kept without a time limit, except that when a school leaves, all of that school's data is deleted, including these summaries |
| Account and student records | Kept until deleted; deleted with the school's data when a school leaves, or on an erasure request |
Who sees what
Data is separated by school and by role. This is enforced by the server on every request, not by what the app shows. A parent's access is limited to their own children.
A parent sees the current state of their own children, how confident it is, and a timeline with each entry's source and time (up to 30 days of history). Parents do not see raw detection data, the bus's live position, other children, or the identity of individual staff.
Accounts
There is no self-registration. Accounts are issued by schools.
Information the platform holds about account holders and how it is handled
- Phone numbers are stored for sign-in accounts. They are treated as personal data and kept out of logs by design.
- Email address, where it is used for sign-in.
- Push-notification registration tokens identify an app install, not a person's location. They are removed on sign-out, when the notification service reports them invalid, and when the user is removed.
- Sign-in is provided by Google Firebase Authentication (phone one-time code or email) and notifications are delivered through Google Firebase Cloud Messaging, so those providers process the data needed for those functions.
- The platform's records themselves are held in a PostgreSQL database, not in Firebase.
This website's hosting
This site is hosted on Google Firebase Hosting. Like most web hosts, the host may keep standard request logs (for example IP address and requested page) that Samipyo does not use for analytics. Details will be confirmed in the final notice.
Questions
For questions, see the contact page.
Legal basis, consent wording, the identity of the operating organisation and rights-request procedures are still being finalised and will be added after legal review.